Privacy Notice
Version: 2026-11-07
This notice explains what personal data VergeOptics ("the service", "we") processes, why, who can see it and what your rights are. It accompanies the Terms of Service & Clinical Disclaimer.
1. Who is responsible
The data controller is the operator of VergeOptics, Israel, reachable at vergeoptics@gmail.com. A registered business name and postal address will be published here when the business is registered.
2. What we store
| Category | Data | Why |
|---|---|---|
| Account | Name, e-mail address, profile picture URL and account identifier from the provider you sign in with (Google, Facebook or e-mail link); the session tokens that keep you signed in | To identify you and keep you signed in |
| Consent | The version of the Terms you accepted and the time of acceptance | To prove and honour your agreement |
| Role and approval | Patient / therapist / administrator; approval status; who approved you and when; for therapists the practice name and licence or registration number you entered | To open the right parts of the service to the right people and to verify therapists |
| Intake form | Your answers to the Medical History & Symptom Baseline questions and the risk flags derived from them; the reviewer's note | So your therapist or an administrator can decide whether the training is suitable and supervise it safely |
| Calibration | Screen width, resolution, pixel ratio, viewing distance and interpupillary distance for each device you calibrate; a hash of the browser's user-agent string to recognise the device | To size the stimuli correctly |
| Programme | Your daily plan and goals, set by your therapist or by default | To run your training |
| Sessions | For every recorded session: exercise, start and end time, settings, the calibration used, each trial (demand, target, your answer, response time, time-outs) and events (breaks, recoveries, pauses, abandon), and a computed summary; milestones | To show your progress to you and your therapist and to adjust the exercises |
| Invitations | The e-mail address an invitation was sent to, who sent it, when it expires and whether it was accepted (and with which address) | To link patients to therapists |
| Audit log | Who approved, rejected, disabled, re-assigned or invited whom, and when; data exports | Security and accountability |
Health data (the intake form, symptom ratings and session results) is sensitive data. We process it on the basis of your explicit consent given when you accept the Terms and submit the form, and — where you are treated by a clinician — for the purposes of that care. Legal bases: we process your account and training data to provide the service you asked for (performance of a contract), and your health-related data on the basis of your explicit consent given when you accept these terms, which you may withdraw by asking for your account to be deleted. Where the GDPR applies, these are Article 6(1)(b) and Article 9(2)(a). Retention: your data is kept while your account exists and deleted within 90 days of a deletion request or of the account being closed, except records we must keep by law (payment records, up to 7 years).
3. Who can see your data
- You, in the app, including a full export.
- Your therapist: the therapist you are linked to (the one who invited you, or the one an administrator assigned) can see your profile, intake answers, programme, sessions and progress.
- Administrators of the service can see every account in order to approve users, assign therapists, answer support requests and keep the service secure. Their actions are recorded in the audit log.
- Nobody else. We do not sell personal data and we do not share it with third parties for their own purposes.
4. Processors and transfers
Running the service involves the following categories of providers, which process data on our behalf under contract: hosting of the application and the database; e-mail delivery (sign-in links and invitations); sign-in providers (Google, Facebook) when you choose to use them; analytics (Google Analytics 4) when enabled. The providers currently are: the hosting and database providers for the application (Vercel, United States, with the application and its database located in Frankfurt, Germany; or Amazon Web Services when the service moves there), the e-mail delivery provider, and Google for sign-in when you choose it. Providers outside your country process data under contracts that apply the same obligations as this notice (standard contractual clauses where the GDPR applies). We will update this list when a provider changes.
5. Cookies and analytics
- Strictly necessary cookies: a session cookie that keeps you signed in and a token that protects forms against cross-site request forgery. These are needed for the service to work.
- Analytics cookies: when the operator has enabled Google Analytics 4, it sets cookies to count visits and page views and to see which parts of the app are used. Analytics never receives your intake answers, session results or any other medical data; the exercise display itself is never tracked. Analytics cookies are set only after you accept them in the cookie notice shown on your first visit; declining keeps the service fully usable. No analytics run on pages behind sign-in.
- The app also stores your preferences (for example the colour theme) in your browser's local storage; this data does not leave your device.
6. Your rights
Depending on where you live, you have the right to access, correct, export and delete your data, to restrict or object to its processing, to withdraw consent, and to complain to a supervisory authority.
- Export: use the export in the app (History & data) at any time.
- Deletion: ask us to delete your account; we will do so within a reasonable time, except where we must retain records by law. Deleting your account removes your sessions, intake form, calibrations and programme.
- Correction: your name and therapist details can be edited in the app; for anything else, contact us.
Under the Israeli Privacy Protection Law, and under the GDPR or UK GDPR where they apply to you, you may ask to see the personal data we hold about you, to have it corrected or deleted, to receive a copy of it (the app's export), and to object to or restrict its processing; where processing rests on consent you may withdraw it at any time. Write to the address below; we answer within 30 days. You may also complain to your data-protection authority (in Israel, the Privacy Protection Authority).
7. Security
Data is stored in a managed PostgreSQL database with encrypted connections. Sign-in tokens and invitation tokens are stored hashed. Access is restricted by role and ownership on every request, and administrative actions are logged.
8. Changes
We may update this notice. The version date at the top changes when we do, and material changes are announced in the app.
9. Contact
Privacy requests: vergeoptics@gmail.com. A postal address will be published here when the business is registered.